fix: four defects found by the portfolio audit (serial leak, dead entity gate, solar wipe, Off revert) (#35)

Security — diagnostics leaked the appliance serial four times over. POINTTAPI
writes it to address, device_id and uuid (config_flow), none of which were in
TO_REDACT_CONFIG; and _redact_path_response looked for a top-level "uuid" key
that real {"id": ..., "value": ...} responses never carry, so /gateway/uuid's
value went out in the clear too. The existing test only exercised the key shape
that never occurs in live data, which is why this read as covered.

Local-path entities were all disabled by default. Five platforms gated
entity_registry_enabled_default on an opt-in list read from the config entry;
no code has ever written those keys, in any released version, and the options
flow writes to entry.options rather than entry.data. A fresh XMPP install
therefore showed climate + water_heater and hid everything else. Noisy
telemetry is already demoted through entity_category, so the gate bought
nothing. Existing installs are untouched — the default only applies to newly
registered entities.

Solar removal ran on unreliable input. An absent /solarCircuits key deleted the
solar device and every entity registry entry on it, but the coordinator
silently skips paths that fail, so one timeout during startup destroyed a
solar user's entity ids, customisations and history association with no way
back. Skipping the descriptions stays unconditional (harmless, reversible);
only the deletion now requires a refresh that succeeded and returned data.

Off -> Heat reverted within one poll. Off is stored as manual mode at min_temp;
setting Heat wrote only userMode, leaving the setpoint at 5 C, so the next
coordinator update re-ran the is_off detection and flipped the card back. The
pre-Off setpoint is captured on the way in and restored on the way out.

Also: the test harness stubbed custom_components.bosch.sensor as an empty shell
module, which made its async_setup_entry unimportable and is why the sensor
platform sat at 0%. It is imported for real now; no test needed changing.
__init__.py takes SWITCH from const rather than re-exporting it through the
switch platform.

574 tests pass, ruff clean, coverage 70.6% -> 72%. Every fix has a test that
fails without it.

Author: CaseyRo

CHANGELOG.md

@@ -4,14 +4,39 @@ All notable changes to this Bosch Home Assistant custom component will be docume
 
 ## [Unreleased]
 
+### Security
+- **Diagnostics no longer leak the appliance serial.** POINTTAPI stores the
+  serial under `address`, `device_id` *and* `uuid` in the config entry, none of
+  which were redacted, and `/gateway/uuid`'s value passed through untouched
+  because the redactor matched a top-level `uuid` **key** that real
+  `{"id": ..., "value": ...}` responses never have. Four plaintext copies in a
+  file testers routinely paste into public issues.
 ### Added
 - **Native-first Boost controls** — Redesigned POINTTAPI Boost controls with dedicated per-zone switches (`switch.*_boost`), serialized multi-zone activation via `asyncio.Lock` to prevent race conditions on rapid toggles, and integration into climate preset modes (`boost` / `none`) across all locales (#34).
 - **Dedicated Heating Circuit (`hc1`) device partition** — Moved circuit-level heating settings away from individual room thermostat devices to a dedicated **Heating Installation** (`/heatingCircuits/hc1`) device to accurately reflect hardware topology.
   - **Before:** Global circuit settings (e.g. supply limits, heating slope, boost duration/temperature) were incorrectly attached to the `zn1` room device (Zone 1 / Thermostat), duplicating or misattributing installation-wide properties.
   - **After:** Supply limits (`supplyTemperatureLimitMax`, `supplyTemperatureLimitMin`), heating dynamics (`heatupCoolingSlope`, `buildingHeatup`), and global Boost settings (`boostTemperature`, `boostDuration`, `boostRemainingTime`) are properly assigned to the Heating Circuit (`/heatingCircuits/hc1`) device, ensuring clean device separation in Home Assistant (#34).
-
+### Fixed
+- **Local (XMPP/HTTP) entities are no longer all disabled on a fresh install.**
+  Every sensor, binary sensor, switch, select and number gated its
+  registry-enabled default on a per-entity opt-in list read from the config
+  entry — which nothing has ever written, in any released version. New local
+  installs showed a climate and water-heater entity and hid the rest. Existing
+  installs keep whatever they already have; only newly registered entities are
+  affected.
+- **Solar devices survive a failed refresh.** A missing `/solarCircuits` key
+  removed the solar device *and every entity registry entry on it* — entity
+  ids, customisations and history association, irrecoverably. The coordinator
+  swallows per-path fetch failures, so one timeout during startup was enough.
+  Removal now requires a refresh that actually succeeded and returned data.
+- **Turning a zone back on after Off no longer snaps back to Off.** `Off` is
+  written as manual mode at the minimum temperature; restoring the mode without
+  the setpoint left the zone at 5 °C, so the next poll re-detected `Off` and
+  reverted the card. The pre-`Off` setpoint is now restored with the mode.
 ### Changed
 - **Read-only number paths** — Number entities for POINTTAPI resources that are read-only (`writeable: 0` or `False`) are now hidden/unavailable, ensuring number entities only represent interactive setpoints and controls (#34).
+- The sensor platform is imported for real by the test harness instead of being
+  stubbed, so its setup path can be tested at all. Coverage 70.6% → 72%.
 
 ## [1.5.1-beta.1] — 2026-08-31
 

custom_components/bosch/__init__.py

@@ -79,7 +79,6 @@ def _get_sensor_class_no_print(device_type, sensor_type):
 from homeassistant.util import dt as dt_util
 from homeassistant.util.json import load_json
 
-from .switch import SWITCH
 
 from .pointtapi_client import PoinTTAPIClient
 from .pointtapi_coordinator import PoinTTAPIDataUpdateCoordinator
@@ -90,6 +89,7 @@ def _get_sensor_class_no_print(device_type, sensor_type):
     ACCESS_KEY,
     ACCESS_TOKEN,
     BINARY_SENSOR,
+    SWITCH,
     CLIMATE,
     CONF_DEVICE_TYPE,
     CONF_PROTOCOL,

custom_components/bosch/binary_sensor.py

@@ -7,7 +7,6 @@
 
 from .bosch_entity import BoschEntity
 from .const import (
-    BINARY_SENSOR,
     CONF_PROTOCOL,
     POINTTAPI,
     SIGNAL_BINARY_SENSOR_UPDATE_BOSCH,
@@ -58,7 +57,6 @@ async def async_setup_entry(hass, config_entry, async_add_entities):
     uuid = config_entry.data[UUID]
     rt_data = config_entry.runtime_data
     gateway = rt_data.gateway
-    enabled_sensors = config_entry.data.get(BINARY_SENSOR, [])
     rt_data.binary_sensor = []
 
     for bosch_sensor in gateway.sensors:
@@ -71,7 +69,7 @@ async def async_setup_entry(hass, config_entry, async_add_entities):
                     gateway=gateway,
                     name=bosch_sensor.name,
                     attr_uri=bosch_sensor.attr_id,
-                    is_enabled=bosch_sensor.attr_id in enabled_sensors,
+                    is_enabled=True,
                 )
             )
 

custom_components/bosch/diagnostics.py

@@ -4,19 +4,32 @@
 from typing import Any
 
 from homeassistant.config_entries import ConfigEntry
+from homeassistant.const import CONF_ADDRESS
 from homeassistant.core import HomeAssistant
 from homeassistant.helpers.redact import async_redact_data
 
-from .const import CONF_PROTOCOL, POINTTAPI
+from .const import CONF_DEVICE_ID, CONF_PROTOCOL, POINTTAPI, UUID
 
 TO_REDACT_CONFIG = {
     "access_token",
     "refresh_token",
     "access_key",
     "password",
     "expires_at",
+    # POINTTAPI writes the appliance serial to all three of these
+    # (config_flow._async_create_pointtapi_entry). It is the pairing
+    # identifier in /gateways/{device_id}/resource/, and testers paste
+    # diagnostics into public issues.
+    CONF_ADDRESS,
+    CONF_DEVICE_ID,
+    UUID,
 }
 
+# Paths whose *value* identifies the appliance. POINTTAPI responses are
+# shaped {"id": ..., "value": ...}, so the key-based checks below never see
+# these — the serial sits under "value" and has to be matched on the path.
+_IDENTIFYING_PATH_SUFFIXES = ("/uuid", "/serialnumber", "/macaddress")
+
 
 async def async_get_config_entry_diagnostics(
     hass: HomeAssistant, entry: ConfigEntry
@@ -49,6 +62,8 @@ def _redact_path_response(path: str, resp: Any) -> Any:
     if not isinstance(resp, dict):
         return resp
     redacted = dict(resp)
+    if path.lower().endswith(_IDENTIFYING_PATH_SUFFIXES) and "value" in redacted:
+        redacted["value"] = "**REDACTED**"
     if "uuid" in redacted:
         redacted["uuid"] = "**REDACTED**"
     if "serialNumber" in redacted:

custom_components/bosch/number.py

@@ -2,7 +2,6 @@
 
 from __future__ import annotations
 
-from bosch_thermostat_client.const import NUMBER
 from homeassistant.components.number import NumberEntity
 from homeassistant.components.number.const import NumberMode
 from homeassistant.helpers.dispatcher import async_dispatcher_send
@@ -43,7 +42,6 @@ async def async_setup_entry(hass, config_entry, async_add_entities):
         return True
     uuid = config_entry.data[UUID]
     gateway = rt_data.gateway
-    enabled_switches = config_entry.data.get(NUMBER, [])
     data_number = []
     for switch in gateway.number_switches:
         data_number.append(
@@ -55,7 +53,7 @@ async def async_setup_entry(hass, config_entry, async_add_entities):
                 name=switch.name,
                 attr_uri=switch.attr_id,
                 domain_name="Switches",
-                is_enabled=switch.attr_id in enabled_switches,
+                is_enabled=True,
             )
         )
     for circ_type in CIRCUITS:
@@ -72,7 +70,7 @@ async def async_setup_entry(hass, config_entry, async_add_entities):
                         attr_uri=switch.attr_id,
                         domain_name=circuit.name,
                         circuit_type=circ_type,
-                        is_enabled=switch.attr_id in enabled_switches,
+                        is_enabled=True,
                     )
                 )
     rt_data.number = data_number

custom_components/bosch/pointtapi_entities.py

@@ -1360,6 +1360,9 @@ def __init__(
         self._uuid = uuid
         self._language = _coordinator_language(coordinator)
         self._zone_id = zone_id
+        # Setpoint in force before HVACMode.OFF wrote min_temp, so OFF -> HEAT
+        # can put it back. None when we did not observe the transition.
+        self._pre_off_target: float | None = None
         self._attr_unique_id = f"{entry_id}_pointtapi_{zone_id}"
         self._attr_device_info = _resolve_device_info(
             uuid,
@@ -1500,6 +1503,8 @@ async def async_set_hvac_mode(self, hvac_mode: str) -> None:
         """
         if hvac_mode == HVACMode.OFF:
             try:
+                if self._hvac_mode != HVACMode.OFF and self._target is not None:
+                    self._pre_off_target = float(self._target)
                 await self.coordinator.client.put(f"/zones/{self._zone_id}/userMode", "manual")
                 await self.coordinator.client.put(f"/zones/{self._zone_id}/manualTemperatureHeating", self.min_temp)
                 self._hvac_mode = hvac_mode
@@ -1514,6 +1519,7 @@ async def async_set_hvac_mode(self, hvac_mode: str) -> None:
                 ) from err
             return
 
+        was_off = self._hvac_mode == HVACMode.OFF
         if hvac_mode == HVACMode.AUTO:
             path = f"/zones/{self._zone_id}/userMode"
             value = "clock"
@@ -1522,6 +1528,21 @@ async def async_set_hvac_mode(self, hvac_mode: str) -> None:
             value = "manual"
         try:
             await self.coordinator.client.put(path, value)
+            # Leaving OFF needs the setpoint back as well: OFF is stored as
+            # manual + min_temp, so restoring only the mode leaves the zone at
+            # min_temp and the next poll re-detects OFF and reverts the UI.
+            if was_off:
+                restored = (
+                    self._pre_off_target
+                    if self._pre_off_target is not None
+                    and self._pre_off_target > self.min_temp
+                    else self.min_temp + 0.5
+                )
+                await self.coordinator.client.put(
+                    f"/zones/{self._zone_id}/manualTemperatureHeating", restored
+                )
+                self._target = restored
+                self._pre_off_target = None
             self._hvac_mode = hvac_mode
             self.async_write_ha_state()
             await self.coordinator.async_request_refresh()

custom_components/bosch/select.py

@@ -4,7 +4,6 @@
 For more details about this platform, please refer to the documentation at...
 """
 from __future__ import annotations
-from bosch_thermostat_client.const import SELECT
 from homeassistant.components.select import SelectEntity
 from homeassistant.helpers.dispatcher import async_dispatcher_send
 
@@ -41,7 +40,6 @@ async def async_setup_entry(hass, config_entry, async_add_entities):
         return True
     uuid = config_entry.data[UUID]
     gateway = rt_data.gateway
-    enabled = config_entry.data.get(SELECT, [])
     rt_data.select = []
     selects = gateway.switches.selects
     for select in selects:
@@ -54,7 +52,7 @@ async def async_setup_entry(hass, config_entry, async_add_entities):
                 name=select.name,
                 attr_uri=select.attr_id,
                 domain_name="Select",
-                is_enabled=select.attr_id in enabled,
+                is_enabled=True,
             )
         )
     async_add_entities(rt_data.select)

custom_components/bosch/sensor/__init__.py

@@ -5,7 +5,6 @@
     RECORDING,
     REGULAR,
     SENSOR,
-    SENSORS,
 )
 from bosch_thermostat_client.const.easycontrol import ENERGY
 from homeassistant.helpers import device_registry as dr
@@ -68,7 +67,13 @@ async def async_setup_entry(hass, config_entry, async_add_entities):
             # first coordinator refresh returned no usable /solarCircuits/sc1 data.
             # This stops non-solar households from seeing four ghost entities.
             solar_available = _solar_data_available(coordinator.data or {})
-            if not solar_available:
+            # Skipping the descriptions is harmless and reversible. *Removing*
+            # an existing solar device is neither — it destroys entity_ids,
+            # customisations and history association. coordinator.data can be
+            # missing /solarCircuits after a timeout or a partial bulk envelope
+            # (the coordinator swallows per-path failures), so only remove once
+            # a refresh has actually succeeded and returned data.
+            if not solar_available and coordinator.last_update_success and coordinator.data:
                 _remove_solar_registry_entries(hass, uuid)
             descriptions = [
                 desc
@@ -115,7 +120,6 @@ async def _do_backfill(_now=None):
         return True
     uuid = config_entry.data[UUID]
     gateway = rt_data.gateway
-    enabled_sensors = config_entry.data.get(SENSORS, [])
 
     new_stats_api = config_entry.options.get("new_stats_api", False)
     rt_data.sensor = []
@@ -140,7 +144,7 @@ def get_sensors(sensor):
                         gateway=gateway,
                         name=sensor.name,
                         attr_uri=sensor.attr_id,
-                        is_enabled=sensor.attr_id in enabled_sensors,
+                        is_enabled=True,
                         **kwargs
                     )
                 ],
@@ -157,7 +161,7 @@ def get_sensors(sensor):
                         sensor_attributes=energy,
                         attr_uri=sensor.attr_id,
                         new_stats_api=new_stats_api,
-                        is_enabled=sensor.attr_id in enabled_sensors,
+                        is_enabled=True,
                     )
                     for energy in EnergySensors
                 ],
@@ -174,7 +178,7 @@ def get_sensors(sensor):
                         sensor_attributes=energy,
                         attr_uri=sensor.attr_id,
                         new_stats_api=new_stats_api,
-                        is_enabled=sensor.attr_id in enabled_sensors,
+                        is_enabled=True,
                     )
                     for energy in EcusRecordingSensors
                 ],
@@ -203,7 +207,7 @@ def get_sensors(sensor):
                         attr_uri=sensor.attr_id,
                         domain_name=circuit.name,
                         circuit_type=circ_type,
-                        is_enabled=sensor.attr_id in enabled_sensors,
+                        is_enabled=True,
                     )
                 )
     async_add_entities(rt_data.sensor)

custom_components/bosch/switch.py

@@ -16,7 +16,6 @@
     POINTTAPI,
     SIGNAL_BOSCH,
     SIGNAL_SWITCH,
-    SWITCH,
     UUID,
 )
 from .pointtapi_entities import (
@@ -67,7 +66,6 @@ async def async_setup_entry(hass, config_entry, async_add_entities):
         return True
     uuid = config_entry.data[UUID]
     gateway = rt_data.gateway
-    enabled_switches = config_entry.data.get(SWITCH, [])
     data_switch = []
     for switch in gateway.regular_switches:
         data_switch.append(
@@ -79,7 +77,7 @@ async def async_setup_entry(hass, config_entry, async_add_entities):
                 name=switch.name,
                 attr_uri=switch.attr_id,
                 domain_name="Switches",
-                is_enabled=switch.attr_id in enabled_switches,
+                is_enabled=True,
             )
         )
     for circ_type in CIRCUITS:
@@ -96,7 +94,7 @@ async def async_setup_entry(hass, config_entry, async_add_entities):
                         attr_uri=switch.attr_id,
                         domain_name=circuit.name,
                         circuit_type=circ_type,
-                        is_enabled=switch.attr_id in enabled_switches,
+                        is_enabled=True,
                     )
                 )
     rt_data.switch = data_switch

unittests/conftest.py

@@ -36,11 +36,10 @@
 # executing the real __init__.py.
 _bosch_pkg.create_notification_firmware = MagicMock()
 
-# Also make the sensor sub-package discoverable
-_sensor_pkg = ModuleType("custom_components.bosch.sensor")
-_sensor_pkg.__path__ = [str(REPO_ROOT / "custom_components" / "bosch" / "sensor")]
-_sensor_pkg.__package__ = "custom_components.bosch.sensor"
-sys.modules.setdefault("custom_components.bosch.sensor", _sensor_pkg)
+# The sensor sub-package is imported for real (not shelled like the parent):
+# its __init__.py has no heavy side effects, and shelling it made
+# async_setup_entry unreachable from tests — which is why the sensor platform
+# setup had no coverage at all.
 
 
 # ── Fixtures ─────────────────────────────────────────────────────────────────